HHS - Digital Forensics Analyst

• Bachelor’s degree in Cybersecurity, Digital Forensics, Information Technology, or related field.
• Minimum 5–8 years of experience performing digital forensic investigations.
• Hands-on experience with endpoint, server, network, and cloud forensics.
• Strong knowledge of forensic acquisition, analysis, and evidence handling procedures.
• Experience supporting enterprise incident response and breach investigations.
• Familiarity with federal incident response and reporting requirements.
• Strong analytical, documentation, and communication skills.
• Active GCFA, GCFE, EnCE, or GCIH (preferred).

• Conduct digital forensic investigations following cybersecurity incidents, data breaches, and suspected malicious activity.
• Perform forensic acquisition and analysis of endpoints, servers, cloud workloads, network traffic, logs, and removable media.
• Preserve digital evidence in accordance with chain-of-custody and evidentiary handling requirements.
• Identify incident origin, timeline, scope, and extent of compromise using forensic methodologies.
• Analyze malware artifacts, scripts, and suspicious files to determine functionality and impact.
• Support reverse engineering and de-obfuscation of malicious content when required.
• Correlate forensic findings with SIEM, EDR, network, and cloud telemetry.
• Produce detailed forensic reports documenting methodology, findings, evidence, and recommendations.
• Support incident containment, eradication, and recovery activities through forensic insight.
• Assist with investigations involving PII, PHI, and other sensitive data in coordination with HRSA Privacy and Legal teams.
• Support FOIA searches, OGC litigation holds, and OIG criminal investigations as required.
• Maintain forensic toolsets, images, and procedures in accordance with HRSA SOPs.
• Participate in cyber exercises, tabletop exercises, and after-action reviews.
• Provide expert guidance to SOC Analysts, Incident Responders, and Threat Hunters.
• Ensure compliance with NIST SP 800-61, NIST SP 800-86, and HHS incident response guidance.

Powered by JazzHR